Mac scareware gang evades Apple's new anti-malware defenses
Within hours of Apple's security fix, new fake security scam appears
Computerworld - The gang responsible for a month-long plague of fake Mac security software has already updated their "scareware" to evade defenses Apple put in place late Tuesday, a security company confirmed today.
"Apple's [antivirus] did not detect the new sample," said Peter James, a spokesman for Intego, a French firm that develops Mac security software.
According to James, the new malware file is identified as "mdinstall.pkg" and if installed, plants the phony MacGuard software on the victim's Mac.
Intego confirmed what ZDNet blogger Ed Bott reported earlier Wednesday, that the scammers had created a new version that wasn't detected by Apple's new defenses.
"This isn't surprising, that there's a new variant out almost as soon as Apple released its security update Tuesday," said James. "[The attackers] are following the news, they're efficient."
On Tuesday, Apple released an update for Mac OS X 10.6, aka Snow Leopard, that warns users that they've downloaded fake Mac security software and scrubs machines already infected with the scareware.
Also called "rogueware," scareware is bogus security software that claims a computer is heavily infected with worms, viruses and other malware. Once installed, the worthless program nags users with pervasive pop-ups and fake alerts until they fork over a fee. MacDefender, the generic name for the new series that targets Macs, demands $60 to $80 to cease and desist.
Intego first reported MacDefender in early May, but since then several variants have appeared, including MacGuard, which installs without requiring a password.
The new MacDefender appeared only hours after Apple issued its update yesterday, said James.
"They'll keep doing this," James predicted, referring to the cat-and-mouse game between the hackers who create MacDefender and Apple's efforts to block them.
"It's worked well enough that they're making money off it, or they wouldn't be doing this. Coming out with a new version right after the update, and a new version as soon as Apple announced it was going to release an update, shows that they're planning on staying on top of things," James said.
The move would not have surprised another researcher.
In a Tuesday interview, Chet Wisniewski, a security researcher with U.K.-based Sophos said Apple's update would either accelerate the race or the hackers would give up.
"If they keep doing [MacDefender], it implies they are succeeding at making money," said Wisniewski. "If Apple is able to stymie [MacDefender] 90% of the time or better, does that mean the bad guys will give up or up the ante?"
It seems that they've done the latter, which in James' eyes, wasn't that difficult.
"Apple's defense is signature-based," said James, talking about the antivirus tactic that relies on individual "fingerprints" of each piece of malware for detection. "Part of the new variant's code is the same, but part of it is different."
- Apple hasn't exhausted its supply of Yosemite betas
- 13 pieces of advice for Yosemite beta testers
- The other Apple economy: $2B in devices on eBay
- Apple sends users scrambling for OS X Yosemite
- Long replacement cycle drags down iPad sales
- Apple unwraps OS X Yosemite public beta Thursday
- Apple grows Mac sales by 18% on the back of the MacBook Air
- Want an Apple watch? Just 3D print one
- What to listen for during Apple's earnings call today
- Mac sales will again outstrip industry average
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!